# What are abliterated models?

**An abliterated model is an open language model that has had its refusal direction deleted from its weights. Chat models learn to refuse through one internal direction. Abliteration locates it by comparing harmful and harmless prompts, then removes it, so the model stops refusing without any retraining.**

Abliterated models are the most common kind of uncensored AI model today. For the wider picture, including fine-tuned uncensored models and how they compare, see [What are uncensored AI models?](https://near.ai/uncensored-ai-models)

## Key points

- Abliteration removes one behavior, refusal, and leaves the rest of the model largely as it was.
- It needs no training data and no training run. It needs a few hundred example prompts and some compute.
- The idea comes from 2024 research showing that refusal is "mediated by a single direction" in chat models.
- Models made this way usually carry "abliterated" in their name.
- The cost in quality varies by model. Some lose a little on benchmarks, some recover it with light extra training.

## Is it abliterated or obliterated?

The technique is called abliteration, a play on ablation, the machine-learning term for removing part of a model. Many people search for "obliterated models", and that search finds the same thing. Some models also carry "OBLITERATED" in their name because they were made with [OBLITERATUS](https://github.com/elder-plinius/OBLITERATUS), an open-source abliteration tool.

## How does abliteration work?

You do not need to read code to understand it. Here is the idea in four steps.

**1. A model thinks in directions.** Inside a language model, many concepts it handles appear to be represented as directions in a very large space of numbers. "This is about cooking" is one direction. "This text is formal" is another.

**2. Refusal is one of those directions.** In 2024, researchers tested 13 popular open-source chat models, up to 72 billion parameters. In each one they found a single direction that mediates refusal. Erasing it stopped the model from refusing harmful requests. Adding it made the model refuse even harmless ones ([Arditi et al.](https://arxiv.org/abs/2406.11717)).

**3. You find the direction by comparison.** Run the model on a set of harmful prompts and a set of harmless prompts. Record what happens inside it for each. The average difference between the two sets points at the refusal direction. Labonne's guide used 256 prompts of each kind ([Labonne](https://huggingface.co/blog/mlabonne/abliteration)).

**4. You delete it from the weights.** The model's weights are adjusted so that no part of the model can write along that direction anymore. This is called weight orthogonalization. The change is permanent and the model is saved as a new version. No retraining is involved.

## Who invented abliteration?

The underlying finding comes from Andy Arditi and colleagues, first shared as a blog post and published on arXiv in June 2024 under the title ["Refusal in Language Models Is Mediated by a Single Direction"](https://arxiv.org/abs/2406.11717).

The technique spread through the open-model community from there. Maxime Labonne's guide, ["Uncensor any LLM with abliteration"](https://huggingface.co/blog/mlabonne/abliteration) (June 13, 2024), made it accessible. Labonne credits a notebook by the developer FailSpy, built on the original authors' code.

### Tools that automate abliteration

- **[Heretic](https://github.com/p-e-w/heretic)** removes refusals without retraining. By default it scores each result on two numbers: how often the model still refuses, and how far it drifted from the original model (KL divergence).
- **[OBLITERATUS](https://github.com/elder-plinius/OBLITERATUS)** is another open-source abliteration tool. Models made with it often carry "OBLITERATED" in the name.

Both work only on open models whose weights you can download.

## Abliteration vs fine-tuning

| | Abliteration | Fine-tuning |
|---|---|---|
| What it does | Removes the refusal direction | Retrains the model on new examples |
| Needs a dataset | A few hundred prompts to find the direction | Thousands of training examples |
| Needs a training run | No | Yes |
| Changes style or knowledge | Little | Often |
| Typical name tag | "abliterated" | "uncensored", or a family name like Dolphin |

Fine-tuning can also teach a model new skills at the same time. Abliteration only removes refusals. Some builders do both: abliterate first, then fine-tune lightly to recover quality.

## Do abliterated models lose quality?

Sometimes. The size of the loss depends on the model and the method.

- The original research reported that disabling refusal this way had "minimal effect on other capabilities" across the models tested ([Arditi et al.](https://arxiv.org/abs/2406.11717)).
- Labonne measured a drop across all benchmarks after abliterating Llama 3 8B, then recovered it with a round of preference training called DPO ([Labonne](https://huggingface.co/blog/mlabonne/abliteration)).

The practical rule: test an abliterated model on your own tasks before you depend on it.

## How do you know if a model is abliterated?

- **The name.** Most abliterated models put it in the name, for example `Qwen3.8-27B-abliterated`.
- **The model card.** On Hugging Face, look for the "abliterated" tag and the base model it was made from. As of November 12, 2026, 13,265 models carry the [abliterated tag](https://huggingface.co/models?other=abliterated).
- **The behavior.** Ask it something a mainstream model declines for legitimate work, such as explaining how a known vulnerability is exploited. An abliterated model answers.

## What are abliterated models used for?

The same legitimate uses as other uncensored models: security research on systems you are authorized to test, red-teaming AI products, AI safety research, fiction, and professional questions that mainstream models refuse too often. More in [What are uncensored AI models used for?](https://near.ai/uncensored-ai-models)

Removing refusals does not remove responsibility. You are still accountable for how you use the output, and hosted providers apply their own rules, such as NEAR AI's [Acceptable Use Policy](https://near.ai/acceptable-use-policy).

## How to run an abliterated model privately

You can download an abliterated model from Hugging Face and run it on your own GPU with tools like Ollama or LM Studio. That is fully private, as long as your hardware can hold the model.

If you want a hosted API without giving up privacy, NEAR AI Cloud serves two abliterated models inside secure enclaves. Prompts run inside an enclave that the cloud provider, the model provider and NEAR AI cannot see into, and each response comes with a hardware attestation you can [verify yourself](https://docs.near.ai/cloud/verification).

| Model | Model ID |
|---|---|
| [DeepSeek V4.1 Flash Abliterated](https://near.ai/models/deepseek-ai/DeepSeek-V4.1-Flash-1017-abliterated) | `deepseek-ai/DeepSeek-V4.1-Flash-1017-abliterated` |
| [Qwen 3.8 27B Abliterated](https://near.ai/models/Qwen/Qwen3.8-27B-abliterated) | `Qwen/Qwen3.8-27B-abliterated` |

Context windows and current prices are on each model page.

Both are open to every account, with no application and no identity checks, under the [Acceptable Use Policy](https://near.ai/acceptable-use-policy). The API is OpenAI-compatible.

**[Try an abliterated model privately →](https://cloud.near.ai/?utm_source=organic&utm_medium=seo&utm_campaign=uncensored-hub&utm_content=abliterated-cta)**

## Frequently asked questions

### What does abliterated mean?
It means a model's refusal direction has been removed from its weights. The model answers requests it was trained to refuse.

### Is abliteration the same as jailbreaking?
No. A jailbreak is a prompt that tricks a normal model, and it often stops working. Abliteration changes the model itself, so it behaves the same way on every request.

### Does abliteration need retraining?
No. It finds the refusal direction by comparing how the model handles harmful and harmless prompts, then removes it from the weights. Some builders add light training afterward to recover quality.

### Are abliterated models worse?
They can lose a little on general benchmarks, depending on the model. Labonne recovered the loss on Llama 3 8B with a short round of preference training.

### Are "obliterated models" different from abliterated models?
No. People often search for "obliterated", and some models carry "OBLITERATED" in their name because they were made with the OBLITERATUS tool. Both refer to models with the refusal direction removed.

### Can any model be abliterated?
Only models whose weights you can download. Closed models, such as the ones behind ChatGPT, cannot be abliterated by users. The original study tested 13 open models up to 72B parameters.

### Does abliteration remove all safety?
No. It reduces refusals. Hosted providers still apply usage policies, and the person using the model stays responsible for its output.

### Where can I use an abliterated AI model through an API?
Download one from Hugging Face to run locally, or call abliterated DeepSeek V4.1 Flash and Qwen 3.8 27B privately through [NEAR AI Cloud](https://cloud.near.ai/?utm_source=organic&utm_medium=seo&utm_campaign=uncensored-hub&utm_content=abliterated-faq).

## Sources

1. Arditi et al., [Refusal in Language Models Is Mediated by a Single Direction](https://arxiv.org/abs/2406.11717), arXiv, June 2024.
2. Maxime Labonne, [Uncensor any LLM with abliteration](https://huggingface.co/blog/mlabonne/abliteration), Hugging Face, June 13, 2024.
3. [Heretic](https://github.com/p-e-w/heretic) and [OBLITERATUS](https://github.com/elder-plinius/OBLITERATUS), open-source abliteration tools.
4. NEAR AI, [Verification documentation](https://docs.near.ai/cloud/verification).

## Related

- [What are uncensored AI models?](https://near.ai/uncensored-ai-models)
- [AI for cybersecurity: private, uncensored models](https://near.ai/cybersecurity)
- [The Right to Run](https://near.ai/blog/the-right-to-run)

Canonical page: https://near.ai/abliterated-models